Veille CVE

Recherche « SUSE Linux Enterprise Module for Basesystem 15 SP7 »

1 CVE

Critique 0 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « SUSE Linux Enterprise Module for Basesystem 15 SP7 » ✕
  1. CVE-2026-41054 7.8 Élevée

    SUSE Container suse/sle-micro-rancher/5.3:latest · SUSE Container suse/sle-micro-rancher/5.4:latest · SUSE Container suse/sle-micro/5.5:latest · SUSE Image SLES15-SP4-SAP-BYOS

    In `src/havegecmd.c`, the `socket_handler` function performs a credential check on the abstract UNIX socket (`\0/sys/entropy/haveged`). However, while it detects if the connecting user is not root (`cred.uid != 0`) and prepares a negative acknowledgement (`ASCII_NAK`), it **fails to stop execution**. The code proceeds to the `switch` statement, allowing any local unprivileged user to execute privileged commands such as `MAGIC_CHROOT`.